Singapore’s government has blamed a known Chinese cyber-espionage group for targeting four of its top telecommunications companies as part of a month-long attack.
on a statement MondaySingapore confirmed for the first time that hackers, known as UNC3886, targeted the country’s telecommunications infrastructure, including its largest companies: Singtel, StarHub, M1, and Simba Telecom. The government previously said it was responding to an unspecified attack on its critical infrastructure.
While the intruders were able to breach and access some systems, they did not disrupt services or access personal information, said K. Shanmugam, the country’s coordinating minister for national security.
Google-owned cybersecurity unit Mandiant previously linked UNC3886 as an espionage group possibly working for China. The Chinese government is known to conduct regular cyber-espionage operations, as well preposition for disruptive attacks ahead of the expected invasion of Taiwan, which Beijing has always denied, per Reuters.
UNC3886 is known for exploitation zero-day vulnerabilities in routers, firewalls, and virtualized environments, where cybersecurity tools designed to detect malware are typically out of reach. The hacking group has targeting the defense, technology, and telecom industries throughout the US and the Asia-Pacific region.
In the case of the attack on Singapore’s top telcos, Shanmugam said hackers used advanced tools, such as rootkits, to gain long-term access to their systems.
“At one point, they gained limited access to critical systems but not far enough to disrupt services,” according to a government statement.
According to Reuters, the telcos said in a joint statement that companies often face distributed denial of service and other malware attacks. “We adopt defense mechanisms to protect our networks and make immediate repairs if any issues are found,” the statement read.
The attacks on Singapore telcos follow similar but separate attacks on hundreds of telecom companies around the world in recent years, including in the United States. Many governments are involved these attacks to a Chinese-backed group called Salt Typhoon.
Singapore said the attack carried out by UNC3886 “did not result in the same level of damage as cyberattacks elsewhere,” referring to the Salt Typhoon hacks.








